Unsolved
This post is more than 5 years old
11 Posts
0
19221
November 20th, 2004 03:00
Winampa virus removal
hello... I have seem to delveop weird ticks on my computer... namely not beign able to reach a site which I know for a fact is up...
so I spoke with my host... they told me to speak with my ISP... spoke iwth my ISP and we ran "msconfig" and found that I had the
winampa worm...
does anyone have experience with this worm and can tell me how to remove it... I have minimal experience in diggign deep into my computer but I guess now is a good tiem to learn
I am on Win XP...
thank you kindly.
No Events found!
jwatt
4.4K Posts
0
November 20th, 2004 03:00
This article by TrendMicro should be a good place to begin. It suggests that their online virus scanner can detect this worm. According to the article, there are Microsoft hotfixes for the vulneratilities exploited by the Agobot worm. Are all Windows Critical Updates available from Microsoft installed on your system?
Jim
cnm72
11 Posts
0
November 20th, 2004 04:00
well... no
I have been a very bad geek... would it be ideal for me to download the Service Pack prior to removing the worm or after?
thank you for the input... I appreciate it...
jwatt
4.4K Posts
0
November 20th, 2004 15:00
If you're referring to XP Service Pack 2, it's known that attempting to install SP2 on a machine that's infected with malware will cause severe problems. So you need to get the worm and any other problems reported by your anti-virus software, and Ad-Aware and Spybot, cleaned up before attempting to install SP2.
You might want to enable the XP firewall while doing the cleanup, since the worm you currently have exploits a known Windows XP vulnerability.
Jim
cnm72
11 Posts
0
November 20th, 2004 23:00
jwatt
4.4K Posts
0
November 21st, 2004 00:00
Did you try running TrendMicro's online virus scanner? Some Agobot/Spybot variants are able to disable virus scanners. In case something has, a "second opinion" from HouseCall might be worthwhile.
Jim
cnm72
11 Posts
0
November 21st, 2004 00:00
jwatt
4.4K Posts
0
November 21st, 2004 05:00
Hmmmm...that's odd! Check over the manual removal steps in the TrendMicro article, and see if you see any of the registry entries and hosts file entries described in the article. TrendMicro also has an online scanner. There's a link to it in the article. If a third opinion confirms that the worm isn't there, then maybe it's not there!
Has anything you've done so far changed the symptoms? What site(s) are you having trouble reaching?
Jim
cnm72
11 Posts
0
November 21st, 2004 22:00
jwatt
4.4K Posts
0
November 21st, 2004 22:00
As you know, there's a possibility of a "false positive" if you have Winamp installed. What directory is the file "winampa.exe" in? If you have Winamp installed (I do!), you'll find a file there called "winampa.exe" there. If it's the one and only file by that name, chances are very good that it's the legitimate copy.
It turns out that "right-clicking" on the Winamp file named "winampa.exe", and examining its properties, doesn't provide any information in the case of that file. Apparently the vendor stripped all that information out of the file. That's unfortunate, because it eliminates one way of finding out more about the file, such as whose file it is.
How did the ISP decide that "winampa" was a worm? Without corroborating evidence, like multiple detection by several virus scanners, the fact that the file exists isn't enough - as long as you have installed Winamp. And you've certainly tried many ways of finding viruses, worms, and malware without anything having been discovered.
If Winamp is installed, we should start over with your symptom(s). What site are you unable to reach? What error message do you receive if you try to reach it?
Jim